X.509, SSL, PEM & CSR Certificate Inspector
Decode, inspect, and validate SSL/TLS digital certificates and CSRs in real time with client-side Web Crypto API. Zero network calls and absolute privacy.
100% Client-Side WebCrypto — DLP Safe
Paste Digital Certificate (PEM) or Request (CSR)
Client-side ASN.1 DER inspector and decoder for X.509 v3 certificates, PEM blocks, and CSRs (PKCS #10). View SANs, issuer, validity window, algorithms, and SHA-256 fingerprints.
How Does the X.509 Certificate Inspector Work?
The X.509 v3 format (RFC 5280) is the foundational security standard for Web PKI and protocols such as HTTPS, mTLS, S/MIME, and electronic invoice signatures. A certificate mathematically binds a public key to a domain or corporate identity.
This tool performs ASN.1 DER decoding entirely within browser memory using the native Web Crypto API. No bytes, private keys, or credentials ever leave your machine, ensuring complete DLP compliance.
Anatomy & Structure of X.509 Fields (RFC 5280)
A digital certificate follows a structured ASN.1 binary tree organized into three primary sections:
| Section | Field | Format | Technical Purpose | Canonical Example |
|---|---|---|---|---|
| 1 | TBSCertificate | SEQUENCE | Signed payload containing version, serial, algorithm, issuer, validity, subject, and public key. | v3 (0x02) |
| 2 | Validity | SEQUENCE | Time window bounded by notBefore and notAfter timestamps in UTCTime or GeneralizedTime. | 2026-09-07T00:00:00Z |
| 3 | Subject / Issuer | RDNSequence | Sequence of Relative Distinguished Names containing CN, O, C, ST, L, and other X.500 attributes. | CN=*.box4.dev, O=Box4Dev |
| 4 | SubjectAltNames | OID 2.5.29.17 | List of domains (dNSName) or IP addresses (iPAddress) secured by the certificate. | DNS:box4.dev, DNS:*.box4.dev |
| 5 | SignatureValue | BIT STRING | Cryptographic signature calculated by the issuing CA over the hash of TBSCertificate. | SHA256withRSA |
ASN.1 Parsing Algorithm & Validity Diagnostics
Deterministic parsing and validation pipeline:
- 1. PEM Sanitization & Base64 Decoding: Extract ASCII payload between boundary headers and decode into binary DER ArrayBuffer.
- 2. ASN.1 DER Tree Walking (Tag-Length-Value): Recursive parser identifying SEQUENCE, OID, INTEGER, UTCTime, and BIT STRING nodes.
- 3. Cryptographic OID Mapping: Resolving numeric identifiers to human-readable names (RSA, ECDSA P-256, Ed25519, SANs).
- 4. Web Crypto API Thumbprint Computation: Computing SHA-1 and SHA-256 digests over the raw DER binary without server requests.